Chapter 2. Applying to Become a Member

2.1. Getting started

So, you've read all the documentation, you've gone through the Debian New Maintainers' Guide (or its
successor, Guide for Debian Maintainers),
understand what everything in the hello
example package is for, and you're about to
Debianize your favorite piece of software. How do you actually become a Debian
developer so that your work can be incorporated into the Project?

When you know how you want to contribute to Debian,
you should get in contact with existing Debian maintainers who are working on
similar tasks. That way, you can learn from experienced developers. For
example, if you are interested in packaging existing software for Debian, you
should try to get a sponsor. A sponsor will work together with you on your
package and upload it to the Debian archive once they are happy with the
packaging work you have done. You can find a sponsor by mailing the
<debian-mentors@lists.debian.org> mailing list, describing your package
and yourself and asking for a sponsor (see Section 7.5.1, “Sponsoring packages” and
https://wiki.debian.org/DebianMentorsFaq for more information on
sponsoring). On the other hand, if you are interested in porting Debian to
alternative architectures or kernels you can subscribe to port specific mailing
lists and ask there how to get started. Finally, if you are interested in
documentation or Quality Assurance (QA) work you can join maintainers already
working on these tasks and submit patches and improvements.

One pitfall could be a too-generic local part in your mailadress: Terms like
mail, admin, root, master should be avoided, please see https://www.debian.org/MailingLists/ for details.

Those who prefer one-on-one help (e.g., via private email) should also post to
that list and an experienced developer will volunteer to help.

In addition, if you have some packages ready for inclusion in Debian, but are
waiting for your new member application to go through, you might be able
find a sponsor to upload your package for you. Sponsors are people who are
official Debian Developers, and who are willing to criticize and upload your
packages for you. Please read the debian-mentors FAQ at https://wiki.debian.org/DebianMentorsFaq first.

2.3. Registering as a Debian member

Before you decide to register with Debian, you will
need to read all the information available at the New Members Corner. It
describes in detail the preparations you have to do before you can register to
become a Debian member. For example, before you apply, you have to read the
Debian Social
Contract. Registering as a member means that you agree with and
pledge to uphold the Debian Social Contract; it is very important that
member are in accord with the essential ideas behind
Debian. Reading the GNU Manifesto would also be
a good idea.

The process of registering as a member is a process of verifying your
identity and intentions, and checking your technical skills. As the number of
people working on Debian has grown to over
1000 and our systems are used in several
very important places, we have to be careful about being compromised.
Therefore, we need to verify new members before we can give them accounts
on our servers and let them upload packages.

Before you actually register you should have shown that you can do competent
work and will be a good contributor. You show this by submitting patches
through the Bug Tracking System and having a package sponsored by an existing
Debian Developer for a while. Also, we expect that contributors are interested
in the whole project and not just in maintaining their own packages. If you
can help other maintainers by providing further information on a bug or even a
patch, then do so!

Registration requires that you are familiar with Debian's philosophy and
technical documentation. Furthermore, you need a GnuPG key which has been
signed by an existing Debian maintainer. If your GnuPG key is not signed yet,
you should try to meet a Debian Developer in person to get your key signed.
There's a GnuPG Key Signing
Coordination page which should help you find a Debian Developer close
to you. (If there is no Debian Developer close to you, alternative ways to
pass the ID check may be permitted as an absolute exception on a
case-by-case-basis. See the identification page for more
information.)

If you do not have an OpenPGP key yet, generate one. Every developer needs an
OpenPGP key in order to sign and verify package uploads. You should read the
manual for the software you are using, since it has much important information
that is critical to its security. Many more security failures are due to
human error than to software failure or high-powered spy techniques. See Section 3.2.2, “Maintaining your public key” for more information on maintaining your public key.

Debian uses the GNU Privacy Guard (package gnupg version 1 or better) as its baseline
standard. You can use some other implementation of OpenPGP as well. Note that
OpenPGP is an open standard based on RFC 2440.

If your public key isn't on a public key server such as
subkeys.pgp.net, please read the documentation available at
NM Step 2:
Identification. That document contains instructions on how to put your
key on the public key servers. The New Maintainer Group will put your public
key on the servers if it isn't already there.

Some countries restrict the use of cryptographic software by their citizens.
This need not impede one's activities as a Debian package maintainer however,
as it may be perfectly legal to use cryptographic products for authentication,
rather than encryption purposes. If you live in a country where use of
cryptography even for authentication is forbidden then please contact us so we
can make special arrangements.

To apply as a new member, you need an existing Debian Developer to support
your application (an advocate). After you have
contributed to Debian for a while, and you want to apply to become a registered
developer, an existing developer with whom you have worked over the past months
has to express their belief that you can contribute to Debian successfully.

When you have found an advocate, have your GnuPG key signed and have already
contributed to Debian for a while, you're ready to apply. You can simply
register on our application
page. After you have signed up, your advocate has to confirm your
application. When your advocate has completed this step you will be assigned
an Application Manager who will go with you through the necessary steps of the
New Member process. You can always check your status on the applications status board.

For more details, please consult New Members Corner at the
Debian web site. Make sure that you are familiar with the necessary steps of
the New Member process before actually applying. If you are well prepared,
you can save a lot of time later on.

[1] Version 4 keys are keys conforming
to the OpenPGP standard as defined in RFC 2440. Version 4 is the key type that
has always been created when using GnuPG. PGP versions since 5.x also could
create v4 keys, the other choice having been pgp 2.6.x compatible v3 keys
(also called legacy RSA by PGP).

Version 4 (primary) keys can
either use the RSA or the DSA algorithms, so this has nothing to do with
GnuPG's question about which kind of key do you want: (1) DSA and Elgamal, (2)
DSA (sign only), (5) RSA (sign only). If you don't have any special
requirements just pick the default.

The easiest way to tell
whether an existing key is a v4 key or a v3 (or v2) key is to look at the
fingerprint: Fingerprints of version 4 keys are the SHA-1 hash of some key
material, so they are 40 hex digits, usually grouped in blocks of 4.
Fingerprints of older key format versions used MD5 and are generally shown in
blocks of 2 hex digits. For example if your fingerprint looks like
5B00 C96D 5D54 AEE1 206B AF84 DE7A AF6E 94C0 9C7F
then it's a v4 key.

Another possibility is to pipe the key into
pgpdump, which will say something like Public Key Packet -
Ver 4.

Also note that your key must be self-signed (i.e. it
has to sign all its own user IDs; this prevents user ID tampering). All modern
OpenPGP software does that automatically, but if you have an older key you may
have to manually add those signatures.